XOR and the cost of reusing a key
Break single-byte and repeating-key XOR, then recover both plaintexts from a reused one-time pad by crib dragging.
By the end you can
- Brute-force single-byte XOR and score candidates automatically
- Detect a repeating keysize using normalised Hamming distance
- Recover two plaintexts from a reused pad without ever learning the key
- Explain why key reuse destroys a cipher that is otherwise information-theoretically secure
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
XOR cipher decoder and key recovery
XOR text or hex against a key, brute-force single-byte XOR by English scoring, and recover repeating-key XOR by Hamming-distance keysize detection.
XOR crib dragging for many-time pads
Recover both plaintexts when a one-time pad key is reused, by dragging a guessed word along the XOR of two ciphertexts.
Hex to text converter
Convert hexadecimal to text and back, tolerating whitespace, commas, and `0x` prefixes. Runs entirely in your browser.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
Practice
generated here, checked here, no account and nothing to download
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 9 match in total - see the full index.
- Custom encryptionpicoCTF 2024medium
- Secure Password DatabasepicoCTF 2026medium
- Tap into HashpicoCTF 2025medium
- vault-door-6picoCTF 2019medium
- OTP ImplementationpicoCTF 2020 Mini-Competitionhard
- scrambled-bytespicoMini by redpwnhard
- Some Assembly Required 3picoCTF 2021hard
- triple-securepicoMini by redpwnhard
Checkpoint
Given two ciphertexts under one reused key, recover both plaintexts and describe each crib you used.
Teaching note
The space-XOR-letter trick is the moment this module lands. Show it before the general method: once students see that the XOR of two plaintexts leaks word boundaries for free, crib dragging stops feeling like magic.